[sslh] sslh new petern

[Yves Rutschle]

Hi Gadi,

Please always post questions to the mailing list, others
might be able to answer!

Looking at the trace, I'd suggest you try:

{ name: "zebedee"; host: "localhost"; port: "1234"; probe: [ "^\x02\x02" ]; },

(obviously you need to adapt the port, I don't know what
zebedee listens to)

Cheers,
Y.

On Wed, Nov 06, 2013 at 07:49:43AM +0200, Gadi Dor wrote:
> Dear Sir,
> 
> I have capture zebedee packet in wireshark , I am trying to make pattern
> like in openvpn,
> 
> I use in filter "frame contains  [REGEX string]" , but I can't find the
> right pattern,
> 
> 
> Can You please help ?
> 
> WireShark pcap file: http://www27.zippyshare.com/v/2604414/file.html
> 
> Thank You Again,
> 
> Best Regards
> Gadi